There are many systems that rely on static PIN's to authenticate a user. Some examples of such systems include debit card payments, ATM transactions, and/or cash withdrawal with credit cards. PIN based systems are often not used for internet, or card not present (CNP) types of transactions, because these types of transactions are particularly vulnerable to intercept, compromise, and/or future fraudulent activity. For example, if an unauthorized user acquires a card number and the corresponding PIN, the unauthorized user can impersonate the card owner in future transactions.
The trust model upon which PIN-based systems are based is further made vulnerable because most merchants that accept PINs trust the PIN verification completely, either by choice or by requirement. Compromise of any a single PIN accepting device, such as automatic teller machines (ATM's) or point of sale (POS) readers may result in potential fraud against the system. Although some advances have been made to PIN-based systems, these systems continue to fall short.
One example is RSA's SecurID system, which provides a one-time password (OTP) scheme that employs a hardware device that generates an OTP as a function of the current time.
Another such example identifies three parties: the user, the authorization server, and the service provider. When the user wants to access some service provided by the service provider (s)he is given a OTP. The user submits the password to the service provider and subsequently the service provider forwards the password to the authentication server. If the one time password is correct for the user, the authentication server sends an authentication service ID for the user to the service provider. This signals a successful authentication.
Yet another such example pertains to a system for securing access to resources by means of a password that automatically changes after every use.
A final example describes a OTP scheme that employs cues and passwords. A user will pick a sequence of ordered cues and the corresponding passwords during registration. A cue could be a word, an image, a picture, etc. Whenever the user wants to access a resource of interest, (s)he has to authenticate herself/himself to the authentication manager (AM). The AM will start by presenting the next cue. After seeing this cue, the user is must input the corresponding password. If the user inputs the correct password, the AM will authenticate the user, and will present the next cue from the list of ordered cues during the next request.
In each of these systems, even those in which the PIN is not static, the user can be impersonated. Once an unauthorized user gains access to a device of an authorized user, the unauthorized user will be able to access future PIN's. A methodical brute force dictionary attack on a user's PIN is also possible, so long as the attacker is patient and tries the various PIN numbers over a long interval of time.
Embodiments of the current invention provide solutions to these and other problems.